Privacy Policy

BIGBRO LLC is the controller of personal data described in this policy. We are a limited liability company organised under the laws of the State of New Mexico, United States, with a registered address at 1209 Mountain Road PL NE, STE R, Albuquerque, NM 87110 and an office at 311 Truman St NE, Albuquerque, NM 87108.

For any privacy question, request or complaint, contact info@bigbrollc.com or call +1 (505) 353-0510 during business hours (Monday to Friday, 9:00–17:00 Mountain Time).

This policy applies to personal data we process through this website, through email and telephone contact, and in the course of providing services to business clients.

It does not apply to third-party websites we link to, or to personal data we process solely on behalf of a client as their processor, where the client's own privacy notice governs the relationship with data subjects.

Depending on how you interact with us, we may process the following categories.

• Identity and contact data: name, business email address, telephone number, job title and company name.
• Enquiry content: the message, brief, documents or attachments you choose to send us.
• Contractual data: proposals, statements of work, signed agreements, invoices, payment references and correspondence.
• Client account data: names and business contact details of your staff who work with us during an engagement.
• Technical data: IP address, browser type, device information, referring page, timestamps and error logs generated automatically by our hosting provider for security, diagnostics and abuse prevention.
• Recruitment data, where you apply for a role: CV, cover letter, work history and any information you provide during interviews.

Directly from you, when you email us, telephone us, submit the contact form, respond to a proposal or work with us on an engagement.

Automatically, through server and security logs generated when your browser requests pages from this website.

From third parties, such as publicly available business directories, professional networks, referrals from existing clients, and service providers who process payments or manage communications on our behalf.

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases.

• To respond to enquiries and prepare proposals — consent and steps taken at your request prior to entering a contract.
• To perform contracts, deliver services and manage the client relationship — performance of a contract.
• To issue invoices, collect payment and maintain accounting records — legal obligation and legitimate interests.
• To secure our website and systems, prevent fraud and abuse, and maintain service reliability — legitimate interests.
• To comply with tax, corporate, sanctions screening and other legal obligations — legal obligation.
• To establish, exercise or defend legal claims — legitimate interests.
• To send occasional business updates to existing contacts — legitimate interests, with an opt-out in every message.

This website does not require an account and does not use advertising or cross-site tracking cookies. Any cookies set are strictly necessary for the site to function or to keep it secure.

Our hosting and content delivery providers keep short-lived technical logs, including IP addresses, for security monitoring and reliability. These logs are not used to build marketing profiles.

If we introduce optional analytics in future, we will update this policy and request consent where legally required. Most browsers also allow you to block or delete cookies through their settings.

We do not sell personal data, and we do not share personal data for cross-context behavioural advertising.

We disclose personal data only where necessary, to the following categories of recipient, under written agreements that restrict their use of the data.

• Service providers: hosting and infrastructure, email delivery, document storage, accounting and payment processing.
• Professional advisers: lawyers, auditors, insurers and accountants, where required for the establishment or defence of legal claims or for compliance.
• Contractors and freelancers within our trusted delivery network, bound by confidentiality obligations, where they work on your engagement.
• Authorities and regulators, where disclosure is required by law, court order or lawful request.
• An acquirer or successor entity, in the context of a merger, acquisition, financing or sale of assets, subject to this policy continuing to apply.

BIGBRO LLC is established in the United States, and our operations involve partners and contractors in other jurisdictions, including Europe, Asia and other regions.

If you contact us from outside the United States, your personal data will be transferred to and processed in the United States and potentially in other countries whose data protection laws may differ from those of your own country.

Where required, we implement appropriate safeguards for such transfers, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with contractual confidentiality and security commitments. Copies of the relevant safeguards can be requested at info@bigbrollc.com.

We keep personal data only for as long as necessary for the purposes described in this policy, and then delete it or securely anonymise it.

• Enquiries that do not lead to an engagement: up to twenty-four (24) months from the last contact.
• Client contractual and project records: for the duration of the engagement and seven (7) years thereafter, in line with tax and accounting requirements.
• Invoices and accounting records: seven (7) years, or longer where required by applicable law.
• Security and server logs: typically up to ninety (90) days, unless retained longer for the investigation of an incident.
• Recruitment data: twelve (12) months after a decision, unless you ask us to keep it on file for future openings.

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls based on the principle of least privilege, multi-factor authentication on business-critical accounts, vetting of contractors, written confidentiality obligations and periodic review of vendors.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we maintain procedures to detect, respond to and, where required by law, notify affected individuals and regulators of a personal data breach without undue delay.

Subject to your jurisdiction and to applicable exemptions, you may exercise the following rights.

• Access: obtain confirmation of whether we process your personal data and receive a copy of it.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: request deletion where the data is no longer needed or processing was based on consent you withdraw.
• Restriction and objection: limit or object to processing based on legitimate interests, including direct marketing.
• Portability: receive certain data in a structured, commonly used, machine-readable format.
• Withdraw consent: at any time, without affecting processing carried out before withdrawal.
• Non-discrimination: exercise your rights without receiving a lower level of service.

Send requests to info@bigbrollc.com with enough information for us to locate your records. We may ask for reasonable verification of identity, particularly where the request concerns sensitive information.

We respond within thirty (30) days, or within forty-five (45) days where permitted for California residents, and will notify you if an extension is required. Authorised agents may submit requests on your behalf with written proof of authorisation.

You may also lodge a complaint with your local supervisory authority. Residents of the European Economic Area and the United Kingdom may complain to their national data protection authority; United States residents may contact their state Attorney General.

Residents of California, Colorado, Connecticut, Virginia and other states with comprehensive privacy laws have the rights described above, including the right to know, delete, correct and opt out of sale or sharing.

We have not sold or shared personal information for monetary or other valuable consideration in the preceding twelve (12) months, and we do not knowingly process sensitive personal information for purposes requiring a right to limit.

We do not use automated decision-making that produces legal or similarly significant effects concerning you.

Our website and services are intended for business users. We do not knowingly collect personal data from children under sixteen (16). If you believe a child has provided us with personal data, contact info@bigbrollc.com and we will delete it promptly.

We may update this policy to reflect changes in our practices, technology, service providers or legal requirements. The effective date shown alongside this document indicates the current version.

Where changes are material, we will take reasonable steps to notify affected individuals, for example by email to client contacts or a notice on this website.